CVE-2022-21701

Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that th...

Privilege escalation

Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that th...

Authorization

Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12...

CVE-2022-21701 Privileged Escalation in Istio

Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that th...

CVE-2022-21701

Istio CVE-2022-21701 affects Istio releases 1.12.0 and 1.12.1. The issue is a privilege escalation via the Kubernetes Gateway API: users with CREATE permissions on gateways.gateway.networking.k8s.io can elevate privileges to create resources they wouldn’t normally access (e.g., Pod). Impact is li...

CVE-2022-21701 Privileged Escalation in Istio

Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that th...

CVE-2022-21679 Authorization Policy bypass in Istio

Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12...

CVE-2022-21679

Istio 1.12.0/1.12.1 contains a bug in the authorization policy that uses the new Envoy API with the 1.11 data plane. This causes hosts and notHosts in authorization policies to be matched regardless of header values when mixing 1.12 control plane with 1.11 data plane, potentially bypassing ALLOW ...

CVE-2022-21679 Authorization Policy bypass in Istio

Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12...

Istio 授权问题漏洞

Istio is an open platform for connecting, managing, and securing microservices. Istio is vulnerable to an authorization issue in versions 1.12.0 and 1.12.1, which stems from a lack of authentication measures or insufficient authentication strength in a networked system or product. An attacker cou...

Istio 权限许可和访问控制问题漏洞

Istio is an open platform for connecting, managing, and securing microservices. versions 1.12.0 and 1.12.1 of Istio are vulnerable to privilege permission and access control issues that could be exploited by attackers to escalate privileges to create additional resources they may not have access ...

Mesh-Kridik - An Open-Source Security Checker That Performs Various Security Checks On A Kubernetes Cluster With Istio Service Mesh And Is Leveraged By OPA (Open Policy Agent) To Enforce Security Rules

Enhance your Kubernetes service mesh security !! mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report. The security checks tests are the full implementation of istio security best practic...

OSV-2021-1658 Null-dereference READ in istio.io/istio/security/pkg/util.ExtractJwtAud

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42142 Crash type: Null-dereference READ Crash state: istio.io/istio/security/pkg/util.ExtractJwtAud...

olcne security update

olcne 1.2.5-2 - Update Istio to 1.9.8 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781 - Update proxyv2 image to select iptables legacy or latest based on host operating system - Turn off Istio PodDisruptionBudget istio 1.9.8-3 - Updated iptables-switch f...

olcne security update

olcne 1.3.2-2 - Turn off default PodDisruptionBudget in istio template to unblock kubernetes module upgrade - Update Kubernetes version to 1.20.11 to address CVE-2021-25741 - Update Istio to 1.9.8, 1.10.4 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781 -...

olcne istio istio kubernetes security update

olcne 1.3.2-2 - Turn off default PodDisruptionBudget in istio template to unblock kubernetes module upgrade - Update Kubernetes version to 1.20.11 to address CVE-2021-25741 - Update Istio to 1.9.8, 1.10.4 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781 -...

Important: Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 2.1.0 RPMs

Red Hat OpenShift Service Mesh 2.1.0 Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. The OpenShift Service Mesh release notes provide information on the features and...

GHSA-HQXW-MM44-GC4R Istio Fragments in Path May Lead to Authorization Policy Bypass

Impact Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with fragment in the path may bypass Istio’s URI path based authorization policies. Patches Istio 1.11.1 and above Istio 1.10.4 and above Istio 1.9.8 and above Workarounds...

GHSA-HQXW-MM44-GC4R vulnerabilities

Vulnerabilities for packages: istio-pilot-discovery, istio-pilot-agent, istio-cni, istio-operator...

Istio Fragments in Path May Lead to Authorization Policy Bypass

Impact Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with fragment in the path may bypass Istio’s URI path based authorization policies. Patches Istio 1.11.1 and above Istio 1.10.4 and above Istio 1.9.8 and above Workarounds...